• Stars
    star
    442
  • Rank 98,051 (Top 2 %)
  • Language
    Python
  • Created over 7 years ago
  • Updated over 5 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Converter for raw RubberDucky payloads to Digispark Arduino IDE Sketch source.

duck2spark by MaMe82 (Marcus Mengs)

This project provides a python script capable of converting payloads generated by DuckEncoder to an Arduino Sketch source targeting DigiSpark. The script solves two problems:

  • Available solutions and tutorials emulating a RuberDucky on a DigiSpark suffer from poor keyboard layout support for non-US languages. This is solved by "outsourcing" the problem to DuckEncoder which supports multiple keyboard layouts.
  • Solutions using DigiKeyboard.print() and DigiKeyboard.println() suffer from string size restrictions, due to DigiSparks RAM limitations (less than 512 Bytes available). This is solved by storing the payload in FLASH memory

Additional features

  • Support for DuckyScript "DELAY" and "REPEAT" command
  • Option for initial delay, to cope with missing key presses, due to insufficient time for driver initialization on target.
  • Option to repeat payload execution (counted loop, single run, endless run)
  • Option to blink status LED when payload execution is finished (on by default, except endless loop)

Project files

  • duck2spark.py - Main script
  • README.rst - this file
  • example.sh - Example script building a payload by running DuckEncoder followed by duck2spark.py (encoder.jar has to be present)
  • example.duck - RubberDucky script with test cases used by example.sh

Requirements

  • Arduino IDE to compile and upload the generated Sketch to DigiSpark
  • Arduino IDE has to be configured to program a DigiSpark, following this guide
  • One, two or many DigiSparks ;-)
  • DuckEncoder to generate a raw payload from DuckyScript, if you want to stay away from Java use my python port of DuckEncoder
  • Python 2 installation

Usage

  1. Generate a DuckyScript test.duck you want to use as output:

    echo "STRING Hello World" > test.duck
    
  2. Compile the script using DuckEncoder with your keyboard layout (de in example) or use my python port:

    java -jar encoder.jar -i test.duck -o raw.bin -l de
    
  3. Use duck2spark.py to convert into Arduino Sketch (options for single run, 2 seconds startup delay):

    duck2spark.py -i raw.bin -l 1 -f 2000 -o sketch.ino
    
  4. After setting up the Arduino IDE load the example "DigisparkKeyboard" and replace the Sketch source by the one saved to sketch.ino .

To get help on duck2spark.py run duck2spark.py -h

Getting started with DuckyScript

Here's an introduction to DuckyScript

Additional Hints on using DuckEncoder in conjunction with duck2spark

  • DuckEncoder has an issue encoding "GUI" or "WINDOWS" key without an additional key. The common scenario on Windows is a key combination like "GUI r", but using "GUI" alone would produce the incorrect character e as output. The issue is adressed here. As there hopefully will be a patch duck2spark doesn't handle this issue. In fact it isn't possible to distinguish between "GUI" key and "e" key in an already encoded script. A patched version of Encoder.java could be found here.
  • Using long delays in a DuckyScript results in big payloads, as delays longer than 250 milliseconds are split up into multiple delays, with a maximum of 250 milliseconds each. Each of these delays consumes 2 bytes in the final payload. As the memory of digispark is far more limited, it is suggested to use duck2spark's delay options instead. Duck2spark relies on DigiKeyboard.delay() and is more friendly in terms of memory consumption.
  • Using the "PREPEAT <N>" instruction in DuckyScript results in repeating the whole key sequence of the former command and thus consumes <N> times as much memory in the final payload. Again, as Digispark is short on memory, it is suggested to use duck2spark's loop option whenever possible. Printing out a 10 character string 500 times by using "REPEAT 500" results in a payload 10000 bytes in size, which is to large for Digispark. Encoding a DuckyScript with a single 10 character string consumes only 20 bytes and could be combined with duck2spark.py -l 500 to achieve a 500 times repetition without further memory consumption.

More Repositories

1

UnifyingVulnsDisclosureRepo

Formerly private repository for discussion, knowledge- and code-sharing around new Unifying vulns, as announced on Twitter
Go
153
star
2

duckencoder.py

Python port of infamous duckencoder for RubberDucky
Python
122
star
3

misc

Python
94
star
4

P4wnP1_WiFi_covert_channel_client

P4wnP1 - WiFi covert channel - Client agent (experimental Proof of Concept) by MaMe82
C#
78
star
5

P4wnP1-Wiki

45
star
6

nmap-omg-cable

An nmap NSE script which is able to detect and enumerate (dump payloads and settings) of O.MG cables, connected to defender controlled networks. Could optionally remote trigger the self destruct functionality of the cable.
Lua
39
star
7

LucaAppIssues

Dokumentation zu Fehlern im Fachsystem Luca (und der LucaApp)
33
star
8

frida-dynamic-hooking

Frida: callback based hooking of Java classes loaded at runtime
TypeScript
29
star
9

munifying_pre_release

29
star
10

lmidns

Go
9
star
11

awareness_wifi

backup of old setup for awareness talks on WiFi
Python
8
star
12

P4wnP1_HID_backdoor_client

C#
6
star
13

hl

6
star
14

ratepatch

Python
6
star
15

ls19_tsh_mod

C
5
star
16

P4wnP1_nexmon_additions_wifi_covert_channel

Python
5
star
17

john-1-8-0-jumbo_raspbian_jessie_precompiled

4
star
18

random_stuff

3
star
19

unifying_analysis

2
star
20

antigen_intercept

To help somebody
JavaScript
2
star
21

P4wnP1_hostapd-mana_additions

hostapd-mana by @singe (@sensepost) precompiled for Raspbian Kernel 4.9.51+
2
star
22

sslstrip2

SSLStrip version to defeat HSTS
Python
2
star
23

periph_debounce_edge_demo

Quick demo of my debouncing approach and context based 'WaitForEdge' with periph.io on RPi0w
Go
1
star